A Time‑of‑Check to Time‑of‑Use flaw (CWE‑367) in the cp utility of uutils coreutils allows an attacker to bypass the no‑dereference intent by swapping a regular file for a symbolic link between the check and the open operation, exploiting the lack of the O_NOFOLLOW flag (CWE‑59). The attacker may use concurrent write access to perform the swap and then cause a privileged cp process to copy the contents of arbitrary sensitive files into a destination the attacker controls, resulting in exposure of confidential data.

The vulnerability affects the Uutils coreutils product, specifically the cp command. No version numbers are provided, so all current releases that include the cp utility could be vulnerable until a fixed version is released.

The CVSS score of 4.7 marks it as moderate severity. The EPSS score is reported as less than 1 %, indicating a low probability of exploitation currently. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require the attacker to have concurrent write access to the source or destination location and the ability to run the cp command with elevated privileges. Without proper mitigations, the risk remains of confidential data being disclosed.